The Rise of “Kitty” Malware: A New Threat Exploiting Drupal Vulnerabilities

Introduction

While the internet has famously catapulted many felines to stardom, the latest buzz surrounding Drupal is far from adorable. The emergence of the “Kitty” malware, a malicious software exploiting a critical remote code execution (RCE) vulnerability in Drupal, has cybersecurity experts on high alert.

The Kitty Malware: A Closer Look

Researchers at Imperva have shed light on this new threat, describing it as an advanced Monero cryptocurrency miner that leverages a ‘webminerpool’ software for browsers. The malware uses a backdoor to establish control on infected servers, allowing attackers to remotely execute scripts and make swift updates.

Nadav Avital, security research team leader at Imperva, highlights the dual nature of the Kitty malware, infecting both web servers and browsers. This necessitates distinct detection and protection measures to mitigate its impact.

Prevention and Mitigation Strategies

Avital recommends fixing vulnerable code, applying patches, or implementing virtual patch solutions to prevent infections. Monitoring CPU consumption in web browsers can also help detect abnormal activity, such as excessive mining causing loud CPU fan noise.

Broader Implications of Drupal Vulnerabilities

Rod Soto, director of security research at JASK, underscores the significance of vulnerabilities in CMS frameworks like Drupalgeddon 2.0. These systems, comprising a substantial portion of the internet, are attractive targets for botnet herding and various malicious activities.

Soto warns that while the Kitty malware is currently focused on crypto-mining, it may evolve to execute more sophisticated attacks in the future. Criminals could exploit Drupal vulnerabilities for spam, identity theft, financial fraud, DDoS attacks, and other nefarious purposes.

Conclusion

In the ever-evolving landscape of cybersecurity threats, the emergence of the Kitty malware underscores the importance of proactive security measures. By staying vigilant, applying patches, and monitoring for unusual activity, organizations can safeguard their systems against this and other emerging threats.